How to Write a Business Continuity Plan (BCP) for Your SME

A fire in your building, a key employee off long-term, a supplier that suddenly stops trading, a three-day power cut. For a small or mid-sized business, these aren't disasters you can solve with a good backup. They're questions that belong in a business continuity plan: a document that describes how your business keeps running when something fundamental stops working. In this article, we explain what a business continuity plan is, how it relates to an IT disaster recovery plan, and how, as an SME, you can put one together in six steps so it's genuinely ready when you need it.

What exactly is a business continuity plan?

A business continuity plan, usually shortened to BCP, is an organisation-wide playbook of procedures describing how mission-critical processes continue during and after a significant disruption. It isn't a technical document but a strategic plan that touches HR, customer service, logistics, finance and IT alike.

Many business owners confuse a BCP with a disaster recovery plan (DRP). The difference matters: a DRP is written for restoring IT systems after an outage, which makes it a technical sub-plan within the broader BCP. A BCP answers questions such as "what do we do if our building is unusable?" or "how do we keep delivering if our biggest supplier goes bust?". The DRP answers "how do we get our servers, data and applications back online?". You need both, but mixing them up is a common pitfall. If all you have is a disaster recovery plan, you're only covering part of the risk.

How it differs from a Business Impact Analysis

Before you can write a BCP, you need to know what takes priority. That's what the Business Impact Analysis (BIA) is for. For each process, the BIA maps out how critical it is, the financial and operational impact of downtime per hour or per day, and the dependencies involved (people, suppliers, IT systems, location). The BIA therefore provides the input for the RTO (Recovery Time Objective) and RPO (Recovery Point Objective) of each process, and determines where your continuity strategy should focus.

SMEs often underestimate this step: they write a plan before it's clear what actually needs protecting. The result is a BCP in which everything seems equally important and nothing comes first. A good BIA isn't an academic exercise but a set of choices: what has to be running again within 4 hours, what can wait a day, and what can wait a week.

ISO 22301 as a framework

If you want to know what a professional BCP looks like, ISO 22301 is the international standard. The current version is ISO 22301:2019, in force since 31 October 2019 and extended with a climate amendment in February 2024. In the Netherlands, the standard is published as NEN-EN-ISO 22301:2019. Supporting guidance can be found in NEN-EN-ISO 22313:2020.

For an SME, full certification against ISO 22301 is rarely necessary or affordable. The standard is, however, an excellent source of inspiration. It forces you into a structured approach: understanding your context, leadership commitment, BIA, risk analysis, strategy, plan, testing, learning, improving. If you already have ISO 27001 or are considering it, you'll recognise the structure, and the two standards work perfectly well side by side.

NIS2 makes continuity mandatory for many SMEs

The Dutch Cybersecurity Act (Cyberbeveiligingswet), which implements NIS2, was passed by the Dutch House of Representatives on 15 April 2026 and is expected to come into force around 1 July 2026. In the designated sectors (including digital infrastructure, energy, transport, drinking water, financial markets, food, postal services and the manufacture of certain goods), medium-sized and large organisations must meet a duty of care covering ten categories of measures. One of those categories is business continuity: backups, emergency arrangements, crisis management and periodic testing. For essential entities, the maximum fine runs up to €10 million or 2% of worldwide annual turnover.

The financial sector has been subject to DORA, the Digital Operational Resilience Act, since 17 January 2025, with similar but stricter requirements for operational resilience. And even businesses that fall outside NIS2 or DORA are increasingly asked by customers and in public tenders to demonstrate a BCP.

Which threats should a Dutch SME's BCP really cover?

A BCP isn't a list of every conceivable disaster; it focuses on the scenarios that are relevant to your business. A few threats that are realistic for Dutch SMEs:

• Cyberattacks. According to research by The Hague University of Applied Sciences (De Haagse Hogeschool), around 12% of SMEs have at some point fallen victim to ransomware; in 2024 the Dutch National Cyber Security Centre (NCSC) recorded 121 unique ransomware incidents in the Netherlands.
• Power outages. In April 2025, Hans-Peter Oskam (director of Netbeheer Nederland, the association of Dutch grid operators) described a 72-hour power cut in the Netherlands as a realistic scenario, and the Iberian blackout that same month brought Spain and Portugal to a standstill for around 18 hours.
• Losing a key person. Research shows that 71% of small businesses depend on one or two key people. Burnout, an accident or a sudden departure then becomes an operational crisis.
• Suppliers and the supply chain. The BCI Horizon Scan 2025 lists third parties and critical infrastructure among the top five concerns for the year ahead.
• Fire, flooding, weather. Not the most likely, but the most disruptive: a building that's out of use for a few weeks affects every function in your business.
• IT and telecoms outages. A bigger risk for cloud workplaces than for local servers, and therefore an explicit part of a continuity plan.

The statistic that's often quoted (40% of businesses never reopen after a disaster) can't be traced back to primary research. What is solid: a Databarracks figure shows that only around 30% of small businesses have a BCP, compared with 73% of large enterprises. SMEs are structurally more vulnerable.

Building a workable BCP in six steps

A BCP for an SME isn't a year-long project; you can have a working first version within two to three months. The process in six steps:

1. Business Impact Analysis

For each department, list which processes exist, how often they run, who carries them out, and which systems and suppliers they rely on. For each process, set the maximum tolerable downtime (RTO) and the maximum acceptable data loss (RPO). For a typical SME, it works well to sort processes into three tiers: critical (running again within 4 hours), important (within 24 hours) and deferrable (within a week).

2. Risk analysis

For your top processes: which threats are realistic, and what's the impact if they strike? Score each risk on likelihood and impact. A matrix isn't an exact science, but it forces you to make choices. The NCSC, the National Coordinator for Security and Counterterrorism (NCTV) and the Digital Trust Center publish useful threat lists for the Dutch context, including the annual Cyber Security Assessment Netherlands (Cybersecuritybeeld Nederland).

3. Continuity strategy

Decide on a strategy for each top risk. Cloud backup plus an alternative place to work (for example a modern workplace on laptops that work just as well from home). A replacement supplier for your critical supply. An arrangement with a fellow business owner for emergency storage. For each strategy, document the cost and the RTO it lets you achieve.

4. Plan and roles

Write the BCP itself: short, clear instructions for each scenario, with a name next to every role. Who calls the emergency services (112), who informs customers, who arranges replacement workstations, who handles internal communication? A workable BCP contains no academic prose, just a checklist that someone can actually follow in a crisis. Put contact details and alternative channels up front (email doesn't work if the cloud is unreachable).

5. Testing and exercising

An untested BCP is a paper plan. There are different types of exercise:

• Tabletop: the people involved talk through a scenario around a table. Cheap and quick, and you'll find gaps the very first time.
• Walk-through or simulation: the same discussion, but now with real actions (testing the phone tree, visiting the alternative location).
• Functional drill or parallel test: some of your processes actually run on the emergency setup.
• Full-interruption test: the real thing: switching production over to the fallback site. For most SMEs, a tabletop exercise every year and a walk-through every two years is realistic.

6. Maintenance and review

Best practice under ISO 22301: review your BCP at least once a year, as well as after triggers such as reorganisations, office moves, new systems or new suppliers. Clear ownership is crucial. Without an owner, the plan gathers dust within a year.

BCP and insurance: how do they complement each other?

A BCP and a business interruption policy or cyber insurance complement each other. Insurance covers the financial loss; the BCP makes sure you can actually keep working. Since 2025, cyber insurers have routinely required a tested incident response plan, MFA, EDR and regular backups as conditions for cover. If your BCP and cybersecurity are in order, you'll often pay a lower premium, or even be able to get cover at all.

What does a BCP project cost an SME?

To be honest: there are no public statistics on actual average costs. As an indication based on US benchmarks: around $5,000 to $25,000 for a small business and $25,000 to $100,000 for a mid-sized business, including assessment, building the plan, training and maintenance. Comparable amounts are realistic in the Netherlands, usually in euros and heavily dependent on your sector, size and internal resources.

The biggest savings don't come from writing it cheaply but from building it smartly: starting with an SME template based on ISO 22301, rolling it out in phases, and linking the knowledge to an external partner who understands your business context. An IT roadmap helps you plan BCP spending alongside your other IT investments.

Frequently asked questions about business continuity plans

What is the difference between a BCP and a disaster recovery plan?

A BCP is organisation-wide and strategic: how does the business keep running during a disaster, whatever the cause? A DRP is technical and focused on restoring IT systems after an outage. The DRP is a sub-plan within the BCP. A business with only a DRP covers the IT side but leaves HR, supplier and location risks exposed.

Does an SME need ISO 22301 certification?

Almost never. For most SMEs, ISO 22301 is an excellent source of inspiration and a useful framework, not a mandatory certificate. If you need certification for tenders or industry requirements, you can start a certification process. Otherwise, your own BCP, built along the structure of ISO 22301, delivers the same practical value at a fraction of the cost.

How often should I test my BCP?

Best practice: a tabletop exercise at least once a year, plus additional tests after major changes (a new location, new systems, a merger). A more extensive walk-through or functional drill every two to three years is realistic for an SME. What matters is that you test something, not that it's the most complex exercise possible.

Does NIS2 apply to us?

NIS2 applies to medium-sized and large organisations (50 FTE or more, or more than €10 million in turnover) in designated sectors. Many SMEs don't formally fall under NIS2 directly, but they are affected indirectly through customers in the supply chain. Customers will pass continuity requirements on to their suppliers contractually, including smaller SMEs.

Who writes the BCP?

The board or management team is responsible. An internal BCP coordinator (often an operations manager or someone from HR) drives the process. IT provides the DRP input, supplier managers provide the supply chain input, and an external partner can guide the structure, the BIA method and the exercises. A BCP written by IT alone lacks the broader view.

Conclusion

For SMEs, a business continuity plan isn't a luxury or a nice-to-have. It's an honest answer to the question: what do we do when something fundamental stops working? Without a plan, you're relying on improvisation at exactly the moment improvising is hardest. With a workable BCP, built on a sound BIA and linked to your IT disaster recovery plan, your insurance and your supplier agreements, you give your business a real chance of surviving a major disruption and getting back on its feet faster afterwards.

Want a business continuity plan for your SME that fits your business processes, NIS2 requirements and existing IT environment, rather than a binder nobody ever opens? Call TRON Group on +31 85 303 5869 or visit our managed IT page. We carry out the BIA together with your management and key staff, design a plan you can test, and connect technology, insurance and governance so it actually works when it counts.